Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
78
46
20
15
5
Contributors
38
36
26
14
14
Categories
115
81
74
18
18
Platforms
171
3
1
1
Products / Services
70
41
32
30
14
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects suspicious child processes spawned by Microsoft OneNote. This rule identifies attempts to execute malicious embedded objects from a .one file by monitoring for OneNote spawning known LOLBINs (Living Off the Land Binaries) or executables from suspicious paths. This behavior is often associated with initial access and execution techniques used by adversaries.
Detects the use of bitsadmin.exe to download a file from a direct IP address. This technique is often used by adversaries for ingress tool transfer or to establish persistence by downloading malicious payloads directly from an IP address, bypassing typical domain-based filtering or logging.
Detects the use of bitsadmin.exe to download files into suspicious or commonly abused folders such as temporary directories, program data, or user public folders. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
Detects the usage of bitsadmin.exe to download files to uncommon target folders such as AppData or Temp directories. This technique is often used by adversaries for ingress tool transfer or to stage malicious payloads.
Detects new BITS transfer job saving local files with potential suspicious extensions
Page 9 of 9